⚠️ Overview

Telesoft is a malicious automated web vulnerability scanner first identified in 2021 by threat researchers at Sucuri and Imperva, operating as a Python-based bot that systematically probes web applications for common security flaws. Its codebase is closed-source but distributed through private Telegram channels and underground forums, with the original author believed to be a developer using the alias "TeleSoft" from Eastern Europe. The bot is actively maintained and updated to evade detection, with at least three major version releases tracked since its emergence.

🔧 Technical Capabilities

Telesoft employs multi-threaded scanning to rapidly enumerate endpoints, directories, and parameters across target domains. It specifically tests for SQL injection, cross-site scripting (XSS), local file inclusion (LFI), remote file inclusion (RFI), and server-side request forgery (SSRF), using a signature-based payload dictionary that incorporates techniques from the OWASP Testing Guide. The bot can also brute-force administrative login pages using a bundled credential list sourced from recent data breaches. It operates by sending a high volume of concurrent HTTP requests with randomized client headers, but retains a distinctive default User-Agent string: "Telesoft/1.3 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" which changes slightly between versions. Additionally, it fingerprints web application frameworks (e.g., WordPress, Joomla, Drupal) by checking for version-specific files and then launches targeted exploit attempts against known vulnerabilities. Traffic analysis reveals that Telesoft typically scans in bursts of 50–100 requests per second, often originating from residential IP addresses in Russia, Ukraine, and Brazil, making it difficult to block via simple IP blacklists alone.

📜 History & Notable Incidents

First publicly documented in a July 2021 blog post by Sucuri, Telesoft was observed scanning over 3,000 WordPress sites in a single campaign, attempting to exploit the then-unpatched CVE-2021-24407 (a critical SQL injection in the "File Manager" plugin). In September 2022, Imperva's Threat Research Lab linked Telesoft to a series of attacks against e-commerce platforms running Magento, specifically targeting CVE-2022-24086 (a remote code execution vulnerability in Magento Commerce). The bot’s code was partially reverse-engineered by researchers at Akamai in early 2023, revealing a modular design that allows operators to dynamically load new payloads from a command-and-control server. Despite takedown efforts, the bot remains active, with updated variants sighted in campaigns as recently as February 2024.

🔍 Detection Indicators

The primary detection indicator is the User-Agent string: "Telesoft/1.3" (or "Telesoft/1.2") followed by the Internet Explorer compatibility remark. Behavioral fingerprints include extremely rapid sequential requests to common paths like /wp-admin/admin-ajax.php, /administrator/, and /config.php, often without requesting the site's homepage first. Additionally, the bot sends non-standard HTTP headers such as "X-Telesoft: scan" in some versions, and its traffic frequently contains a high ratio of 404 errors from nonexistent endpoints. Network monitoring systems can flag requests that match these patterns and originate from IP ranges associated with known residential proxy networks.

☠️ Risk & Impact

Successful exploitation by Telesoft can lead to full database compromise (via SQL injection), arbitrary code execution (via LFI/RFI), or site defacement, with data exfiltration being a common secondary objective. The bot’s aggressive scanning can also degrade server performance and overwhelm web application firewalls, causing collateral denial-of-service effects. In at least one documented incident, Telesoft exfiltrated 15,000 customer records from a vulnerable e-commerce site before the attack was mitigated.

🛡️ Mitigation

Due to its confirmed malicious nature and history of successful attacks, any traffic matching the Telesoft User-Agent or its behavioral signatures is blocked immediately upon detection at the edge firewall or WAF level. No legitimate use case for this tool exists; it is exclusively employed for unauthorized vulnerability scanning and exploitation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.